CVE-2023-53728

Vulnerability

Description

CVE-2023-53728 is a race condition vulnerability in the Linux kernel's posix_timer_add() function, which allocates IDs for POSIX timers. The issue arises because the starting point for the ID search loop is read without proper locking, allowing a concurrent allocation to modify the cached ID value, potentially setting it to -1 [1]. This can prevent the loop termination condition from ever being true, leading to a soft lockup or denial of service.

Exploitation

An attacker can exploit this race condition by triggering concurrent POSIX timer creation from multiple threads or processes, causing CPU0 to read a stale or negative start value from sig->posix_timer_id. While the probability of a successful abuse is low due to the large ID space constraints, it is possible to consistently cause a soft lockup or hang [2]. No special privileges are required beyond the ability to create POSIX timers.

Impact

Successful exploitation results in a denial of service (DoS), as the affected CPU may enter an infinite loop, degrading system performance or causing a complete hang. The vulnerability does not lead to information disclosure or privilege escalation [3].

Mitigation

The fix, merged into the Linux kernel stable branches, ensures that all ID operations are performed under the hash lock, preventing the race condition [1][2]. Users should update to the latest kernel containing commit ef535e0315af or equivalent backports. No workaround is available without applying the patch.